Abstract: Technologies are described herein for invoking API calls through voice commands. An annotated API description is received at a voice API interface. The annotated API description comprises descriptions of one or more APIs and speech annotations for the one or more APIs. The voice API interface further receives a voice API command from a client. By utilizing the annotated API description and the speech annotations contained therein, the voice API interface converts the voice API command into an API call request, which is then sent to the corresponding service for execution. Once the service returns an API call result, the voice API interface interprets the API call result and further converts it into an audio API response based on the information contained in the annotated API description and the speech annotations. The audio API response is then sent to the client.

Abstract: In a computing environment a request is received from a computing device associated with a user, requesting access to one or more computing resources. An approximate geographic location of the computing device is determined based on geographic information associated with the computing device. Access to the requested one or more computing resources is allowed based on the approximate geographic location of the computing device and geographic policy information for the user.

Abstract: Techniques for managing digital assets are described that enable a principal to designate a plurality of users that will gain access and ownership of the principal's account that contains the various digital assets of the principal in the event of a transfer of assets. The account may be a network accessible account that maintains various digital assets of the principal, such as multimedia, applications, virtual machines, data, and others. In the event of a transfer, access to the account can be controlled by a cryptographic secret, where each of the designated users has been provided with a distinct share (part) of the cryptographic secret. A minimum number of shares of the secret are required before access to the principal's account will be granted. The minimum number may be configured by the principal in advance.

Abstract: A network-based data store maintaining storage volumes for file systems at storage clients may implement dynamic storage volume scaling. A scaling event may be detected according to a specified scaling policy for a storage volume maintained at a network-based data store that is mounted at a storage client and configured for a file system. In a least some embodiments, the scaling policy for the storage volume may be received from the storage client. In response to detecting the storage event, storage maintaining the storage volume may be modified according to the scaling policy to scale the storage volume. An indication of the scaling event may be sent to the storage client in order to update the file system at the storage client so that the file system may utilize the scaled storage volume.

Abstract: Methods and apparatus for enhancing control-plane security of a network-accessible service are described. In accordance with a security policy, one or more control servers are selected to perform administrative operations associated with configuration of a service instance at a particular instance host of a network-accessible service. The control servers may differ in security properties from the instance host. In response to a configuration request directed at the instance host, administrative operations are implemented at the selected control servers. A low-level command is issued for execution to the instance host from a control server. A result of the low-level command is obtained at the control server and is used to determine a response to the configuration request.

Abstract: Methods and apparatus for unified account metadata management are disclosed. A storage medium stores program instructions that when executed on a processor generate a graph representation of metadata associated with a client account of a provider network. At least a portion of the metadata is obtained using an internal mechanism of the provider network. The graph comprises a plurality of nodes (representing resources associated with the client account) and a plurality of edges (representing configuration relationships). The instructions when executed provide a visualization of resources and configuration relationships of the graph; and in response to a graphical interaction with the visualization, issue a command to a network-accessible service of the provider network to implement a configuration modification associated with a resource represented in the graph.

Abstract: A customer submits a set of preferences including hardware specifications for instantiating a virtual machine instance. The virtual machine instance may be instantiated in a physical host computer system that does not conform to the set of preferences. The virtual computer system service may be configured to evaluate the specifications of the available physical host computer systems to determine whether any of the available physical host computer systems conform to the set of preferences. Accordingly, the virtual computer system service may further evaluate the available physical host computer systems to determine whether available physical host computer systems comprise available slots for instantiating the existing virtual machine instance. If the one or more available physical host computer systems have available slots, the virtual computer system service may migrate the existing virtual machine instance to an available physical host computer system in order to fulfill the customer request.